[READ-ONLY] Mirror of https://github.com/FoxxMD/blog.
blog.foxxmd.dev
add more crowdsec intro
+67
-3
+67
-3
_drafts/crowdec-for-homelab.md
+67
-3
_drafts/crowdec-for-homelab.md
···
9
9
mermaid: true
10
10
---
11
11
12
+
[Crowdsec](https://www.crowdsec.net/) is moderately known within the homelab community but the majority of knowledge available, both in the [official documentation](https://docs.crowdsec.net/docs/intro/) and other community article sources, is surface-level and tends to frame its use in the context of a **single machine** where all the web traffic, monitoring, and blocking takes place.
13
+
14
+
This is adequete for toy implementations and beginner usage but falls short in the homelab where:
15
+
16
+
1. web traffic can be distributed across mutliple machines/networks
17
+
2. not all machines are created equal in terms of traffic volume and compute capacity
18
+
19
+
which is unfortunate because Crowdsec is *designed for distributed use* and it's where it shines the brightest. It's also the least documented and most confusing for scaling up.
20
+
21
+
In this article I lay out how to think about Crowdsec for scaling up in the homelab, attempt to fill the void beyond single-instance usage, and provide practical examples for implementing your own homelab-scale Crowdsec solution.
22
+
12
23
## Crowdsec?
13
24
14
-
* What is crowdsec
15
-
* Why should I use it?
16
-
* Maybe explain WAF
25
+
Crowdsec is a multi-component, network security solution designed to detect and prevent bad actors from exploiting your systems. At a high level, it does this by:
26
+
27
+
* *proactively* blocking known bad actors from a crowdsourced database
28
+
* *reactively* detecting suspicious network activity and blocking the associated actor by...
29
+
* monitoring logs from across your systems (web servers, ssh, syslogs, iis, iptables, etc.)
30
+
* matching attack patterns from log lines
31
+
32
+
The solution is composed of:
33
+
34
+
* a crowdsec binary that can be run natively or using a docker container
35
+
* takes configuration through config files
36
+
* can behave as individual components described in [Key Concepts](#key-concepts) below, or can do everything at the same time as an All In One (AIO) solution
37
+
* [Remediation Components](#bouncers), software that communicate with the crowdsec binary to apply rules to network software in order to block actors
38
+
39
+
### Why Should I Use It?
40
+
41
+
It's a fact of life on the public internet that bad actors *will* be probing and trying to exploit your services, if they are accessible. It doesn't matter the size of the web server, what is hosted on it, or how obscure you try to make it: someone will always try to exploit it.
42
+
43
+
Crowdsec is an extremely easy way to harden access and prevent bad actors from even attempting to exploit your services. You benefit greatly by being able proactively block threat actors that have already tried to attack other crowdsec users.
44
+
45
+
TODO add benefits of reactive detection:
46
+
47
+
* react to novel actors
48
+
* benefit from community parsers and scenarios, zero barrier to leveraging these
49
+
50
+
### Why Should I Not Use It?
51
+
52
+
**If you do not have any services exposed to the internet** then Crowdsec may not be necessary for you. Using a properly configured Wireguard server or Tailscale for access to your network bypasses all of the common weakpoints an attacker would be able to probe.
53
+
54
+
**If you need a full IDS/IPS[^detection]** then Crowdsec may not be the best choice. It does not operate on your actual network interfaces, do deep packet inspection, capture or correlate actor activity across the network, or provide audit logs for detected activity. You are better off with something like [Suricata](https://suricata.io/).
55
+
56
+
**If you already use something like [fail2ban](https://github.com/fail2ban/fail2ban)** or have fail2ban configured with bespoke filtering Crowdsec may not have feature parity for you. Setting up fail2ban filters from scratch is much easier than creating your own log parsers and scenarios in Crowdsec.
17
57
18
58
### Key Concepts
19
59
···
23
63
24
64
The Management instance is the "brains" of CrowdSec's security engine. In most non-enterprise settings there is only one Management instance that all other components talk to.
25
65
66
+
<details markdown=1>
67
+
68
+
<summary>Details</summary>
69
+
26
70
The management functionality enables the CS app to:
27
71
28
72
* Recieve decisions ("ban IP X for Y minutes") from [Log Processors](#log-processor)
···
34
78
35
79
Notably, the Management instance does *not* need acquisition config or hub collections/scenarios/etc installed on it. That is only needed on Log Processors.
36
80
81
+
</details>
82
+
37
83
#### Log Processor
38
84
39
85
The CrowdSec application can be deployed with log processing (acquisition) and scenario monitoring functionality. CS docs refer to this functionality as [Log Processing](https://docs.crowdsec.net/docs/next/log_processor/intro).
40
86
41
87
There may be many Log Processor instances of the Crowdsec application, for example one per host. Log Processors are the "senses" (see/hear/touch) of the CrowdSec "brain". They all communicate back to a Management instance.
42
88
89
+
<details markdown=1>
90
+
91
+
<summary>Details</summary>
92
+
43
93
When the CS app is used for Log Processing it:
44
94
45
95
* Has user-defined configuration to tell it what [Data Sources](https://docs.crowdsec.net/docs/next/log_processor/data_sources/intro) to consume, known as [acquistion](https://docs.crowdsec.net/docs/next/log_processor/intro#acquistions)
···
50
100
51
101
Note: Data Source, Parsers, and Scenarios can be installed as bundles called [**Collections**](https://app.crowdsec.net/hub/collections).
52
102
103
+
</details>
104
+
53
105
#### Bouncers
54
106
55
107
A Bouncer is an application, separate from the Crowdsec app, that is used to:
···
59
111
60
112
Crowdsec docs refer to Boucers as [Remediation Components](https://docs.crowdsec.net/u/bouncers/intro). There may be many Bouncers, all communicating with a Management instance. Bouncers are the "weapons" used to react after the CrowdSec "brain" realizes there is an "attack" (decision from Log Processor).
61
113
114
+
<details markdown=1>
115
+
116
+
<summary>Details</summary>
117
+
62
118
Some examples of bouncers, and how they use Management:
63
119
64
120
* [Firewall](https://docs.crowdsec.net/u/bouncers/firewall) - gets all IPs from Decicions stored in the Management instance and applies them as `BLOCK` rules to a host's firewall application (`iptables` or `nftables`)
65
121
* [Traefik](https://plugins.traefik.io/plugins/6335346ca4caa9ddeffda116/crowdsec-bouncer-traefik-plugin) - Installed as a middleware. When a request is intercepted it queries the Management instance for the request IP. If the IP is banned it returns a 403.
66
122
67
123
CS develops and maintains a large list of Bouncers for all popular platforms.
124
+
125
+
</details>
68
126
69
127
## Why Is this post needed?
70
128
···
128
186
129
187
* create bouncer api key in Management
130
188
* install bouncer component or configure for service
189
+
190
+
___
191
+
192
+
## Footnotes
193
+
194
+
[^detection]: Intrustion **Detection** System and Intrustion **Prevention** System